dockerd
+ Step 1:
Step 2: + | + iptables sends traffic to dockerd
Dockerd sends non local DNS | | + |
to host dns via +--------------------------------------------------------------------+
the veth interface | | | | | |
| | | | | |
docker bridge | | | | | |
| | | | | |
+ | | | | | |
| | | | | | |
| | | + | | +-----------------------------+ |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | +----------------------+ | |
| | | | | + | |
| | | | | | |
| | | Veth | | eth0 | |
+-------------------------------------------------------------------+ | |
| | | | | | |
| +------------------------------+ | | | |
| | | | 127.0.0.11:53 | |
| | | | | |
| | | | | |
| | | | | |
| | +------------------------+ | |
| | | | |
| | Step 3: dockerd responds | | |
+ | to DNS request +-----------------------------+ |
| |
| |
| |
| |
| |
| |
| |
| |
+--------------------------------------------------------------------+
Macvtap
+--------------------------------------------------------------------------------------+
| |
+ | |
| | |
| | |
| | |
| | |
| | |
| | +--------------------------------+ |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | +----------------------------+ | |
+-------------------------+ | | Container IP and mac | |
| | +----------------------------+ | |
| | | | |
| | | | |
| | The host side namespace | | |
| | does not have IP or MAC | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | +--------------------------------+ |
| | |
| | |
| | |
+ | |
| |
| |
| |
| |
| |
+--------------------------------------------------------------------------------------+
tc based solution
+
| dockerd
|
|
|
|
|
+---------------------------------------------------------------------------------------+
| | |
| | |
| | |
| Dst 127.0.0.11 Src | Dst Src == Container |
| Src != Container 127.0.0.11 | 127.0.0.11 Port 53 |
| Dst != | +----------------------+ |
| container + ^ | | |
| ^ | | | |
| | | | | | |
| | | | | | |
| | | DNS traffic | | | |
| | | | | | |
| | | | | | |
| | v + | | |
| | | |
+---------------------------------------+ +---------------------+ | |
| | | |
| | | |
| tc rules | | |
Note: The ve|h retains its IP | | |
and mac addr|ss and is in the +-----------------> | | |
network ns | non 127.0.0.11 traffic | |
| + | | |
| <------------------+ | | |
| | | |
| +----------------------+ |
| |
| |
| |
| |
| |
| |
| |
| |
++---------------------------------------------------------------------------------------+